Veriphi: Attack-Guided Neural Network Verification with Dataset-Dependent Training Methods

• URL: http://arxiv.org/abs/2606.18454v1
• Date: Tue, 16 Jun 2026 20:02:51 GMT
• Title: Veriphi: Attack-Guided Neural Network Verification with Dataset-Dependent Training Methods
• Abstract summary: We present a GPU-accelerated neural network verification system that combines fast adversarial attacks with formal bound certification.<n>We demonstrate that training method effectiveness is fundamentally dataset-dependent.<n>We achieve 5x verification speedup through attack-guided falsification and scale our approach to production-size models.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: We present Veriphi, a GPU-accelerated neural network verification system that combines fast adversarial attacks with formal bound certification using alpha,beta-CROWN methods. Through systematic experiments on MNIST and CIFAR-10 using three training methodologies (standard, adversarial, certified), we demonstrate that training method effectiveness is fundamentally dataset-dependent. Interval Bound Propagation (IBP) achieves 78% certified accuracy on simple MNIST (784 dimensions) but provides negligible certification performance on the more complex CIFAR-10 dataset, where PGD adversarial training dominates with 94% certification at small perturbations. We achieve 5x verification speedup through attack-guided falsification and scale our approach to production-size models (105.8M parameters) for real-world aerospace logistics optimization. Our results challenge the assumption that certified training universally outperforms adversarial training, showing context matters critically for verification strategy selection.

Related papers

• Improving Certified Robustness via Adversarial Distillation [2.969291853301593]
  We introduce AD-CERT, a certified training objective that combines adversarial distillation with an IBP upper bound.<n>We show that AD-CERT achieves state-of-the-art certified performance on several benchmarks.
  arXiv  Detail & Related papers  (2026-06-30T13:31:35Z)
• Learning Better Certified Models from Empirically-Robust Teachers [53.51898477987441]
  Adrial training attains strong empirical robustness to specific adversarial attacks by training on concrete adversarial perturbations.<n>It produces neural networks that are not amenable to strong robustness certificates through neural network verification.<n>Earlier certified training schemes directly train on bounds from network relaxations to obtain models that are certifiably robust, but display sub-par standard performance.
  arXiv  Detail & Related papers  (2026-02-02T16:30:53Z)
• Wasserstein distributional adversarial training for deep neural networks [4.0984142455934345]
  We propose methods to train against distributional attack threats.<n>We introduce an efficient fine-tuning method which can be deployed on a previously trained model.<n>We test our methods on a range of pre-trained models on RobustBench.
  arXiv  Detail & Related papers  (2025-02-13T14:18:41Z)
• Cross-Input Certified Training for Universal Perturbations [4.456428506059651]
  Current certified training methods train models robust to single-input perturbations but achieve suboptimal clean and UAP accuracy. We propose a novel method, CITRUS, for certified training of networks robust against UAP attackers. We show in an extensive evaluation across different datasets, architectures, and perturbation magnitudes that our method outperforms traditional certified training methods on standard accuracy (up to 10.3%) and achieves SOTA performance on the more practical certified UAP accuracy metric.
  arXiv  Detail & Related papers  (2024-05-15T08:33:41Z)
• Unsupervised End-to-End Training with a Self-Defined Target [2.6563873893593826]
  We propose a method enabling networks or hardware designed for end-to-end supervised learning to also perform high-performance unsupervised learning. We extend this method to semi-supervised learning, adjusting targets based on data type, achieving 96.6% accuracy with only 600 labeled MNIST samples in a multi-layer perceptron.
  arXiv  Detail & Related papers  (2024-03-18T16:14:28Z)
• IB-RAR: Information Bottleneck as Regularizer for Adversarial Robustness [6.92902550987764]
  Experimental results show that our method can be naturally combined with adversarial training and provides consistently better accuracy on new adversarial examples. Our method also provides good robustness for undefended methods, such as training with cross-entropy loss only.
  arXiv  Detail & Related papers  (2023-02-09T07:50:46Z)
• Accelerating Certified Robustness Training via Knowledge Transfer [3.5934248574481717]
  We propose a framework for reducing the computational overhead of any certifiably robust training method through knowledge transfer. Our experiments on CIFAR-10 show that CRT speeds up certified robustness training by $8 times$ on average across three different architecture generations.
  arXiv  Detail & Related papers  (2022-10-25T19:12:28Z)
• Distributed Adversarial Training to Robustify Deep Neural Networks at Scale [100.19539096465101]
  Current deep neural networks (DNNs) are vulnerable to adversarial attacks, where adversarial perturbations to the inputs can change or manipulate classification. To defend against such attacks, an effective approach, known as adversarial training (AT), has been shown to mitigate robust training. We propose a large-batch adversarial training framework implemented over multiple machines.
  arXiv  Detail & Related papers  (2022-06-13T15:39:43Z)
• To be Critical: Self-Calibrated Weakly Supervised Learning for Salient Object Detection [95.21700830273221]
  Weakly-supervised salient object detection (WSOD) aims to develop saliency models using image-level annotations. We propose a self-calibrated training strategy by explicitly establishing a mutual calibration loop between pseudo labels and network predictions. We prove that even a much smaller dataset with well-matched annotations can facilitate models to achieve better performance as well as generalizability.
  arXiv  Detail & Related papers  (2021-09-04T02:45:22Z)
• Fast Training of Provably Robust Neural Networks by SingleProp [71.19423596238568]
  We develop a new regularizer that is both more efficient than existing certified defenses. We demonstrate improvements in training speed and comparable certified accuracy compared to state-of-the-art certified defenses.
  arXiv  Detail & Related papers  (2021-02-01T22:12:51Z)
• How Robust are Randomized Smoothing based Defenses to Data Poisoning? [66.80663779176979]
  We present a previously unrecognized threat to robust machine learning models that highlights the importance of training-data quality. We propose a novel bilevel optimization-based data poisoning attack that degrades the robustness guarantees of certifiably robust classifiers. Our attack is effective even when the victim trains the models from scratch using state-of-the-art robust training methods.
  arXiv  Detail & Related papers  (2020-12-02T15:30:21Z)
• Unsupervised Domain Adaptation for Speech Recognition via Uncertainty Driven Self-Training [55.824641135682725]
  Domain adaptation experiments using WSJ as a source domain and TED-LIUM 3 as well as SWITCHBOARD show that up to 80% of the performance of a system trained on ground-truth data can be recovered.
  arXiv  Detail & Related papers  (2020-11-26T18:51:26Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.